BMS benchmarking and reverse engineering

Topics concerning OEM and open source BMSes
Post Reply
dadez87
Posts: 5
Joined: Sat Nov 19, 2022 10:58 am

BMS benchmarking and reverse engineering

Post by dadez87 »

Hi Everyone

I would like to support this forum, as well as learn new things about BMS latest technology on the market.
I have HW & SW development skills in general on Electronic Control Units design, and I would like to do a benchmarking analysis of the BMS products currently available on the market, in particular on the latest "top EVs", such as Audi E-Tron GT, Kia Niro EV, Hyundai Ioniq 5 / EV6, etc.

If someone of you, for some reason, has access to the battery pack or modules of any of the vehicles mentioned above, please let me know.
In particular, I would like to have high resolution pictures (and, if possible, the actual samples) related to Master BMS and Slave BMS, and other related PCB-A boards in the pack (example: shunt sensor PCB-A, Junction Box specific PCB-A, sensors etc.)
Parts do not need to be "working" by all means. It is also OK for me to study "junk / broken" parts.

The target of my activity would be:
1) Understand HV electrical layout of the battery pack of each vehicle (PCB-As, wirings, sensors, contactors, etc.)
2) Supposing to have the PCB-A pictures and/or actual boards, perform benchmarking: PCB size, connectors type, listing up components installed on the PCB, reverse engineering of the circuit schematics, etc.

Thank you in advance.
User avatar
Bigpie
Posts: 1585
Joined: Wed Apr 10, 2019 8:11 pm
Location: South Yorkshire, UK
Has thanked: 74 times
Been thanked: 299 times

Re: BMS benchmarking and reverse engineering

Post by Bigpie »

I have various vw gte slave boards, a contactor shunt isolation board and master spare. In uk
VW Beetle 2003
Outlander front generator
Prius Gen 3 inverter (EVBMW logic board)
Outlander charger
3x Golf GTE batteries
Chademo Charging
Outlander water heater
dadez87
Posts: 5
Joined: Sat Nov 19, 2022 10:58 am

Re: BMS benchmarking and reverse engineering

Post by dadez87 »

Bigpie wrote: Sun Nov 20, 2022 8:06 am I have various vw gte slave boards, a contactor shunt isolation board and master spare. In uk
Thank you. Which Model Year is it? Could you please kindly share some pictures of the Master BMS, Slave BMS, and Shunt board?
User avatar
Bigpie
Posts: 1585
Joined: Wed Apr 10, 2019 8:11 pm
Location: South Yorkshire, UK
Has thanked: 74 times
Been thanked: 299 times

Re: BMS benchmarking and reverse engineering

Post by Bigpie »

The BMS slave boards are from Golf GTE and Passat GTE and a newer Passat GTE. The shunt board from a Golf GTE and a BMS master from a Passat GTE. Are you in the UK? I can post them to you
VW Beetle 2003
Outlander front generator
Prius Gen 3 inverter (EVBMW logic board)
Outlander charger
3x Golf GTE batteries
Chademo Charging
Outlander water heater
User avatar
Kutato72
Posts: 23
Joined: Sat Mar 12, 2022 8:03 pm
Location: Hungary, Tata
Been thanked: 18 times
Contact:

Re: BMS benchmarking and reverse engineering

Post by Kutato72 »

I have been doing what you just described here for five years. Will you have a job with it, though I don't know if it's any use? I have already written a lot about this topic to my clients, but unfortunately in Hungarian. I'm copying a material made by Google translate, so maybe the translation is bad, but my English is even worse. :-) (If you use this somewhere, mention that it was written by Peter Varsanyi...)

Before the spread of electric cars in 2008, there were not really dedicated BMS chips on the market, so in the case of cars before 2008, the task was sometimes solved with tragicomic forced solutions. After that, BMS chips spread in three distinct waves, which I would like to present below:

First swallows
The first BMS chip that could be taken seriously was the bq76PL536A-Q1 chip from Texas Instruments (TI), which could handle 3÷6 channels and the so-called Level-Shifter was able to connect several chips in one system with SPI bus. The launch of the Tesla Model S in 2012 was the first eCar to use a modern BMS, and this contributed greatly to the success of the brand. But even this required Tesla to develop its own, unique, non-CAN-based bus system between the chips instead of the short (a few 10 cm) range SPI bus.

As a point of interest, the other extreme, also from 2012, the Nissan LEAF, used a now terribly outdated and discontinued Japanese BMS chip as the central BMS. (That is, they put all the BMS chips on a PCB board, without any kind of bus system, and cabled the voltage of all the cells there). The solution turned out to be so bad that it cannot be (re)used for anything, and today it has become an oft-cited representative of technical counter-work, as it was created based on faulty ideas in every detail.

First wave: CAN-based solutions
With the exception of the first two cuckoo eggs, all the other solutions were built on completely the same foundations: in one half of the BMS panel, galvanically isolated, there is a CAN driver, which receives 12V from the BMS cabling and generates its own 5V power supply from that on the wires lower voltage should not cause problems. And for setting the addresses of the modules, there is a "chain" wire, which physically encodes the CAN base address of the given element of the chain. This is coded with a secret protocol during production, so usually the battery modules (or the CMU panels on them) cannot be freely changed afterwards. And the actual BMS electronics have a small processor that manages some kind of first generation BMS chip. The construction is always a Master-Slave system: the BMU (Battery Management Unit) queries the CMUs (Cell Management Unit) for the voltages and temperatures of the cells, and then controls the balancing circuits of each cell with addressed commands. All battery data – capacity per cell (SoH), battery life, number of charge-discharge cycles, etc. – it is in the memory of the BMU, which is usually not or can only be read in a very convoluted way. CMUs are dumb, they don't store data.

The name of the BMU/CMU pairs varies by manufacturer. (Volvo: BECM/CVTN, BMW: SME/CSC, Bolloré: PCU/MCU). The entire system is also called BMS, as is the final balancing chip itself; this gives the opportunity for quite a lot of misunderstandings.

The main types of the first generation BMS chips: Analog Devices LTC680x (P-iOn, C-Zero, M-Miew, M-Outlander PHEV, BMW), Texas Instruments bq76PL536A (Tesla, Smart ForTwo, Mercedes B250e), or on the order of LG Chem, the unique and secret chip L9763 manufactured by ST Microelectronics (Opel Ampera, Volvo V60 PHEV, Renault Zoe) I would not list all BMS chip types, because approx. There can be 100÷200 types. The chips can only perform basic functions, i.e. cell voltage measurement and balancing, so in many cases other protections are solved at the CPU level, e.g. measuring the battery module voltage (and comparing it with the sum of the cell voltages), or handling additional thermometer inputs.

The disadvantage of CAN-based solutions is that, although the hardware interface between the BMU-CMU is almost identical, each company has created a unique CAN bus protocol, which must be decoded one by one - fortunately, some parts of many protocols are already public, so you don't have to start from scratch. In the case of BMW, it is a special problem that they took legal action against the use of the "intellectual products" developed by them for other purposes; which is especially funny because BMW did not develop a single orphaned program line: the BMS systems were developed by the German Preh GmbH, while the on-board chargers were developed by the Italian MetaSystem S.P.A. delivered. Another interesting thing is the history of TI's bq76PL536A-based chips, because all such BMS systems were developed by Tesla for the Daimler group.

Second wave: CAN-based hybrid solutions
The biggest flaw of the first generation BMS chips is that they do not have any self-diagnostics, so it is quite common for the car to stop due to a chip error, as if it had been nailed to the road. Double BMS solutions are a solution to this, where the smarter BMS chip measures and balances, and the dumber BMS chip only checks the other chip. This is used by the Tesla Model 3/Y (BatMan and Robin chips) and BMW (Preh GmbH), where the LTC6802-2 is the smarter one, and the LTC6801 next to it is the dumber chip that does not perform balancing. Such double BMSs disable charging in the event of a single chip failure, notify the driver (and even the manufacturer immediately) that a fatal failure has occurred, but allow the car to go home or drive to the service center on its own wheels. In the case of Tesla, in the event of a BMS error, charging with a reduced current is also permitted up to a lower charge level.

A completely different approach involves the use of modern, bus-system BMS chips detailed in the next point. Especially for German manufacturers, the TriCore processor of the BMU module contains "embedded" code written in AutoSAR, which is completely unable to handle the high-speed information flow of intelligent BMS chips due to its outdated structure inherited from the gasoline-diesel era. Therefore, the special double SPI bus processor on the CMU panel pre-filters and "pre-digests" the flood of information, and only a dumb, but still difficult to decipher, complex data flow takes place on the CAN bus. The above mixed solution CMU module is also used by the Audi e-Tron, the Jaguar iPace, and the Volkswagen ID.3/ID.4 MEB platform, which is the basis of countless cars, e.g. Skoda, Seat, etc.

Third wave: daisy-chained bus system solutions
The common characteristics of today's modern bus system BMS chips are as follows:
• Two- or four-wire differential SPI transmission with transformer or capacitor isolation, so that individual BMS chips can be daisy-chained.
• There is no "CAN address", the "device number" of the BMS chip comes from its position in the chain, so the BMS modules are completely replaceable.
• The chips contain 2-3 independent (!) A/D converters instead of one, with several independent (!) voltage references, so they can measure the same data in several ways, between which certain correlations must exist. This can filter out A/D errors and voltage reference errors. (The L9763 chip had a type error, e.g. its internal reference was scrambled.)
• The chips are able to handle the even and odd side separately, so they can detect the cell-wire break as the worst and most critical battery fault. (One of the most common causes of battery fires is that the balancer wire going to the BMS breaks between two adjacent cells, and since the input of the BMS chip "sets" to half voltage in this case, it does not notice that one half of the double cell is being undercharged, the the other half gets overcharged and catches fire.)
• The chips are also suitable for On-Chip balancing, i.e. they do not require an external balancer resistor or balancer switch, which results in the elimination of many contact-defective SMD components - however, the balancing algorithm is greatly complicated by the fact that the heating of the chip must be taken into account, or even and odd sides must be balanced separately.

Currently, three companies' bus-based BMS systems are competing with each other, and 5 main chips are fighting for market dominance. The Germans voted for NXP's (cheap but somewhat stupid) solutions, the Asian region (Hyundai, Kia) chose Maxim's currently high-end system, while Volvo, which became Chinese, uses the Texas Instruments solution. The "five":

• NXP MC33771 – max. 14 cells handling, two-wire daisy-chain, protected by NDA
• NXP MC33772 – max. 6 cells handling, two-wire daisy-chain, protected by NDA
• Maxim MAX17823B – max. 12 cells handling, four-wire daisy-chain, public
• Maxim MAX17845 – max. 12 cells handling, four-wire daisy-chain, recently publicized
• TI bq76PL455A – max. 16 cells handling, four-wire daisy-chain, public

Of course, it is also expected that new manufacturers will enter the market, just as newer versions of the above chips are already starting to enter the market. The main differences, e.g. the bit length of the isoSPI bus (40 bits => 48 bits), which also results in a jump in the number of Nodes (chainable chips). The Porsche Taycan e.g. used the NXP MC33772 chip, which allows only 15 Nodes, so the ability to handle 15*6 = 90 cells was not enough for the 800VDC battery, since they used 192 cells. Therefore, the management of 4x48 cell groups was solved with 4 independent buses.

Ps: About the circuit diagrams, if you have deciphered all of the 3 generations, you already know them all. Copy-Paste almost all of them.
dadez87
Posts: 5
Joined: Sat Nov 19, 2022 10:58 am

Re: BMS benchmarking and reverse engineering

Post by dadez87 »

Thank you. I am more or less aligned with the status of Cell Monitoring ICs and their Gateway ICs.
What I would like to benchmark is not only that part of the BMS.

There are much more functionalities in a BMS:
1) Microcontrollers and Smart Regulators architecture (depends on Functional Safety targets)
2) Contactors (relays) management
3) HVIL (High Voltage Inter Lock) circuit
4) CAN and LIN channels (or, others, like Flexray)
5) Temperature sensors
6) Current measurement using shunt resistor or others (Hall sensor, etc.)
7) Crash signal
8) Isolation monitoring circuit
...
In addition to that, there might be interesting solutions on the selection of the connectors, PCB number of layers, population single or both sided, etc.

This is the reason why I would like to have in my hand some of the most recent BMSs (in particular, Master BMS unit, and, if present on the vehicle additional PCB-A used for sensing battery pack current and voltage)

If you have some, please post some pictures for everyone. I can support analyzing them.
Post Reply